diff --git a/server/test/steamSignin.test.js b/server/test/steamSignin.test.js
index 86b5979..8b07904 100644
--- a/server/test/steamSignin.test.js
+++ b/server/test/steamSignin.test.js
@@ -306,6 +306,20 @@ test('the same refusal holds on the mobile bridge (D395)', async () => {
   assert.equal(created, null)
 })
 
+test('a linked Steam account signs in to the app through the mobile bridge (M9)', async () => {
+  userIdentities.findByProviderSubject = async () => ({ id: 3, user_id: 7, provider: 'steam' })
+  mobileBridge.getSession = async () => ({
+    session_id: 'm2', status: 'pending', redirect_uri: 'runicgateway://sso', state: 'app-state',
+    expires_at: new Date(Date.now() + 60_000).toISOString(),
+  })
+  mobileBridge.issueAuthCode = async () => ({ code: 'one-time-code' })
+  const tx = ssoState.createTx({ provider: 'steam', mode: 'mobile', mobileSessionId: 'm2' })
+  const res = mockRes()
+  await ssoCtrl.callback(steamReq(tx), res)
+  assert.equal(res.redirectedTo, 'runicgateway://sso?code=one-time-code&state=app-state')
+  assert.equal(res.cookies[token.COOKIE_NAME], undefined, 'the app gets a code, never a cookie')
+})
+
 test('a forged callback (Steam says is_valid:false) is a refused sign-in, not a server error', async () => {
   installSteam({ valid: false })
   userIdentities.findByProviderSubject = async () => ({ id: 3, user_id: 7 })